PT-2020-16172 · Alfresco+1 · Alfresco Reset Password Add-On+1

CVE-2020-25727

Published

2020-09-17

Updated

2023-04-13

CVSS v3.1

7.5

High

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Alfresco Reset Password add-on versions prior to 1.2.0

Description The issue allows a malicious user to inject a query within the email input field, utilizing CMIS-SQL Injection.

Recommendations For versions prior to 1.2.0, update the Reset Password add-on to version 1.2.0 or later to resolve the issue.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾

ALT-PU-2022-1004

ALT-PU-2022-1478

ALT-PU-2023-1616

CVE-2020-25727

Alt Linux

Alfresco Reset Password Add-On